e44437400b3b88ef7713a43d4ed6e8ea0eb1205645134440d1b4d45e901abf9a | Triage

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 11:36

Sharing

Report Analysis Logs

General

Target

housekeep/WTR50T.dll
Size

19KB
MD5

6fa686d566710b7de37531ac241ad04c
SHA1

27847f9fe511d9382aafece2895f5a03ba6d2845
SHA256

157caeb5ea1cc46be56cd417364641e54119690232e3a7e412516800c1550b77
SHA512

8f5a8adddb4445826a7bcde086126ae5e962ca0fdabf9ebbaa17cdb9bfb993454cf65ce39747f41bbea2b5cdf0e44349cffb9caa370e23af58f7b3aa62437b3f
SSDEEP

384:1x7za27wsGVV10vYmMh4tlat7c5hVj+BgFXpOrAwq2l9U:d7wXVVOv+jtaHKmANx9U

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4828	1420	rundll32.exe	82
PID 1420 wrote to memory of 4828	1420	rundll32.exe	82
PID 1420 wrote to memory of 4828	1420	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\housekeep\WTR50T.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\housekeep\WTR50T.dll,#1
  2⤵
  PID:4828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads